Edit tour

Linux Analysis Report
825.elf

Overview

General Information

Sample name:	825.elf
Analysis ID:	1654395
MD5:	825bab4fd9b73d70e8ac9b79126a85cd
SHA1:	0ea8246ebd864f36585fefb4f94c099c3c64b270
SHA256:	270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43
Tags:	AutoColorelfLinuxuser-KodaDr
Infos:

Detection

Score:	76
Range:	0 - 100

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for dropped file

Multi AV Scanner detection for submitted file

Creates /etc/ld.so.preload

Deletes /etc/ld.so.preload (likely AV evasion)

Sample deletes itself

Contains symbols related to standard C library sleeps (sometimes used to evade sandboxing)

Deletes log files

Executes the "rm" command used to delete files or directories

Sample and/or dropped files contains symbols with suspicious names

Sample has stripped symbol table

Uses the "uname" system call to query kernel version information (possible evasion)

Writes ELF files to disk

Classification

General Information

Joe Sandbox version:	42.0.0 Malachite
Analysis ID:	1654395
Start date and time:	2025-04-02 10:36:55 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultlinuxfilecookbook.jbs
Analysis system description:	Ubuntu Linux 20.04 x64 (Kernel 5.4.0-72, Firefox 91.0, Evince Document Viewer 3.36.10, LibreOffice 6.4.7.2, OpenJDK 11.0.11)
Analysis Mode:	default
Sample name:	825.elf
Detection:	MAL
Classification:	mal76.evad.linELF@0/4@0/0
Cookbook Comments:	Analysis time extended to 480s due to sleep detection in submitted sample

Runtime Messages

Command:	/tmp/825.elf
PID:	6230
Exit Code:	0
Exit Code Info:
Killed:	False
Standard Output:	#install ok #install ok
Standard Error:

Process Tree

system is lnxubuntu20

825.elf (PID: 6230, Parent: 6152, MD5: 825bab4fd9b73d70e8ac9b79126a85cd) Arguments: /tmp/825.elf

825.elf New Fork (PID: 6231, Parent: 6230)

825.elf New Fork (PID: 6232, Parent: 6231)

dash New Fork (PID: 6293, Parent: 4331)

rm (PID: 6293, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.2jcM8VmtlL /tmp/tmp.DhMObyhwF1 /tmp/tmp.Ayz6Aytwqw

dash New Fork (PID: 6294, Parent: 4331)

rm (PID: 6294, Parent: 4331, MD5: aa2b5496fdbfd88e38791ab81f90b95b) Arguments: rm -f /tmp/tmp.2jcM8VmtlL /tmp/tmp.DhMObyhwF1 /tmp/tmp.Ayz6Aytwqw

cleanup

Yara Signatures

⊘No yara matches

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

• AV Detection
• Networking
• System Summary
• Persistence and Installation Behavior
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• HIPS / PFW / Operating System Protection Evasion

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: 825.elf

Avira: detected

Antivirus detection for dropped file

Source: /var/log/cross/auto-color

Avira: detection malicious, Label: LINUX/AVI.Agent.ykqhz

Multi AV Scanner detection for submitted file

Source: 825.elf	Virustotal: Detection: 23%			Perma Link
Source: 825.elf	ReversingLabs: Detection: 22%

Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 34.249.145.219
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.42
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 91.189.91.43
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 109.202.202.202
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178
Source: unknown	TCP traffic detected without corresponding DNS query: 146.70.41.178

Source: unknown	Network traffic detected: HTTP traffic on port 59322 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59460 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59586 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59592 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59448 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59316 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59304
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59796
Source: unknown	Network traffic detected: HTTP traffic on port 59826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59556
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59676
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59550
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59670
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59310
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59430
Source: unknown	Network traffic detected: HTTP traffic on port 42836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59790
Source: unknown	Network traffic detected: HTTP traffic on port 59304 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59568 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59316
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59436
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59322
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59688
Source: unknown	Network traffic detected: HTTP traffic on port 59310 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59574 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59580 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59682
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59442
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59562
Source: unknown	Network traffic detected: HTTP traffic on port 59832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59236 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59328 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59598 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59448
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59568
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59328
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59334
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59212
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59454
Source: unknown	Network traffic detected: HTTP traffic on port 59472 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59574
Source: unknown	Network traffic detected: HTTP traffic on port 59424 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59556 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59694
Source: unknown	Network traffic detected: HTTP traffic on port 59212 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59562 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59218
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59224
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59466
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59586
Source: unknown	Network traffic detected: HTTP traffic on port 59718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59346
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59340
Source: unknown	Network traffic detected: HTTP traffic on port 59418 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59460
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59580
Source: unknown	Network traffic detected: HTTP traffic on port 59922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59628
Source: unknown	Network traffic detected: HTTP traffic on port 59916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59508
Source: unknown	Network traffic detected: HTTP traffic on port 59370 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59502
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59868
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59874
Source: unknown	Network traffic detected: HTTP traffic on port 59430 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59514
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59634
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59400
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59520
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59886
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59880
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59640
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59760
Source: unknown	Network traffic detected: HTTP traffic on port 59796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59376 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59646
Source: unknown	Network traffic detected: HTTP traffic on port 59244 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59406
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59526
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59532
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59652
Source: unknown	Network traffic detected: HTTP traffic on port 59910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59412
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59772
Source: unknown	Network traffic detected: HTTP traffic on port 59850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59892
Source: unknown	Network traffic detected: HTTP traffic on port 59904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59382 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59646 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59436 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 39276
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59418
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59778
Source: unknown	Network traffic detected: HTTP traffic on port 59784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59898
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59538
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59658
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59664
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59424
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59544
Source: unknown	Network traffic detected: HTTP traffic on port 59442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 39276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59844 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59700
Source: unknown	Network traffic detected: HTTP traffic on port 59502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59634 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59256 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59274
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59394
Source: unknown	Network traffic detected: HTTP traffic on port 59388 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59640 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59268 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59508 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59712
Source: unknown	Network traffic detected: HTTP traffic on port 59394 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59652 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59832
Source: unknown	Network traffic detected: HTTP traffic on port 59280 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59286
Source: unknown	Network traffic detected: HTTP traffic on port 59628 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59280
Source: unknown	Network traffic detected: HTTP traffic on port 59754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59670 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59844
Source: unknown	Network traffic detected: HTTP traffic on port 59760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59604
Source: unknown	Network traffic detected: HTTP traffic on port 59616 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59850
Source: unknown	Network traffic detected: HTTP traffic on port 59526 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59658 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59610
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59298
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59292
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59616
Source: unknown	Network traffic detected: HTTP traffic on port 59358 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59520 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59862
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59622
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59742
Source: unknown	Network traffic detected: HTTP traffic on port 59664 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59364 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59622 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59544 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59676 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59406 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59538 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59904
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59598
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59358
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59236
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59478
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59352
Source: unknown	Network traffic detected: HTTP traffic on port 59550 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59230
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59472
Source: unknown	Network traffic detected: HTTP traffic on port 59298 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59604 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59592
Source: unknown	Network traffic detected: HTTP traffic on port 59346 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59478 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59916
Source: unknown	Network traffic detected: HTTP traffic on port 59352 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59910
Source: unknown	Network traffic detected: HTTP traffic on port 59934 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59610 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59484
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59244
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59364
Source: unknown	Network traffic detected: HTTP traffic on port 59928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59532 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59292 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59808
Source: unknown	Network traffic detected: HTTP traffic on port 59286 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59928
Source: unknown	Network traffic detected: HTTP traffic on port 59334 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59802
Source: unknown	Network traffic detected: HTTP traffic on port 59748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59256
Source: unknown	Network traffic detected: HTTP traffic on port 59340 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59376
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59496
Source: unknown	Network traffic detected: HTTP traffic on port 59688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59370
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59490
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59250
Source: unknown	Network traffic detected: HTTP traffic on port 59218 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59814
Source: unknown	Network traffic detected: HTTP traffic on port 43928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59484 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59934
Source: unknown	Network traffic detected: HTTP traffic on port 59224 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59268
Source: unknown	Network traffic detected: HTTP traffic on port 59230 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59388
Source: unknown	Network traffic detected: HTTP traffic on port 59802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59262
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 59382
Source: unknown	Network traffic detected: HTTP traffic on port 59400 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59490 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 59886 -> 443

Source: libcext.so.2.12.dr	ELF static info symbol of dropped file: _Z13pcap_dispatchP4pcapiPFvPhPK11pcap_pkthdrPKhES1_
Source: libcext.so.2.12.dr	ELF static info symbol of dropped file: _Z9pcap_loopP4pcapiPFvPhPK11pcap_pkthdrPKhES1_

Source: ELF static info symbol of initial sample

.symtab present: no

Source: classification engine

Classification label: mal76.evad.linELF@0/4@0/0

Persistence and Installation Behavior

Creates /etc/ld.so.preload

Source: /tmp/825.elf (PID: 6230)

Created: /etc/ld.so.preload

Jump to behavior

Source: /usr/bin/dash (PID: 6293)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.2jcM8VmtlL /tmp/tmp.DhMObyhwF1 /tmp/tmp.Ayz6Aytwqw			Jump to behavior
Source: /usr/bin/dash (PID: 6294)	Rm executable: /usr/bin/rm -> rm -f /tmp/tmp.2jcM8VmtlL /tmp/tmp.DhMObyhwF1 /tmp/tmp.Ayz6Aytwqw			Jump to behavior

Source: /tmp/825.elf (PID: 6230)	File written: /var/log/cross/auto-color			Jump to dropped file
Source: /tmp/825.elf (PID: 6230)	File written: /usr/lib/x86_64-linux-gnu/libcext.so.2			Jump to dropped file

Hooking and other Techniques for Hiding and Protection

Sample deletes itself

Source: /tmp/825.elf (PID: 6230)

File: /tmp/825.elf

Jump to behavior

Source: ELF symbol in initial sample

Symbol name: usleep

Source: /tmp/825.elf (PID: 6230)	Truncated file: /var/log/cross/auto-color			Jump to behavior
Source: /tmp/825.elf (PID: 6232)	Truncated file: /var/log/cross/config-err-20FF3326			Jump to behavior

Source: /tmp/825.elf (PID: 6232)

Queries kernel information via 'uname':

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Deletes /etc/ld.so.preload (likely AV evasion)

Source: /tmp/825.elf (PID: 6230)

Deletion: /etc/ld.so.preload

Jump to behavior

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	Windows Management Instrumentation	Path Interception	1 Process Injection	1 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	1 Exploitation for Defense Evasion	LSASS Memory	1 Virtualization/Sandbox Evasion	Remote Desktop Protocol	Data from Removable Media	1 Application Layer Protocol	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	1 Virtualization/Sandbox Evasion	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	1 Process Injection	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Indicator Removal	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	11 File Deletion	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop

Malware Configuration

⊘No configs have been found

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Number of created Files
Is malicious
Internet

Screenshots

Download Video

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
825.elf	23%	Virustotal		Browse
825.elf	22%	ReversingLabs	Linux.Backdoor.Generic
825.elf	100%	Avira	LINUX/AVI.Agent.ykqhz

Dropped Files

Source	Detection	Scanner	Label	Link
/var/log/cross/auto-color	100%	Avira	LINUX/AVI.Agent.ykqhz
/var/log/cross/auto-color	22%	ReversingLabs	Linux.Backdoor.Generic
/var/log/cross/auto-color	23%	Virustotal		Browse

Domains

⊘No Antivirus matches

URLs

⊘No Antivirus matches

Domains and IPs

Download Network PCAP: filtered – full

Contacted Domains

⊘No contacted domains info

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
146.70.41.178	unknown	United Kingdom	2018	TENET-1ZA	false
34.249.145.219	unknown	United States	16509	AMAZON-02US	false
109.202.202.202	unknown	Switzerland	13030	INIT7CH	false
91.189.91.43	unknown	United Kingdom	41231	CANONICAL-ASGB	false
91.189.91.42	unknown	United Kingdom	41231	CANONICAL-ASGB	false

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
34.249.145.219	IdpLihor52.elf	Get hash	malicious	Unknown	Browse
	Space.mips.elf	Get hash	malicious	Unknown	Browse
	Space.spc.elf	Get hash	malicious	Mirai	Browse
	Space.arc.elf	Get hash	malicious	Mirai	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
	FBI.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	FBI.arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	na.elf	Get hash	malicious	Prometei	Browse
	efefa7.elf	Get hash	malicious	Mirai	Browse
109.202.202.202	kpLwzBouH4.elf	Get hash	malicious	Unknown	Browse	ch.archive.ubuntu.com/ubuntu/pool/main/f/firefox/firefox_92.0%2bbuild3-0ubuntu0.20.04.1_amd64.deb
91.189.91.43	IdpLihor52.elf	Get hash	malicious	Unknown	Browse
	Space.mips.elf	Get hash	malicious	Unknown	Browse
	rrrdsl.elf	Get hash	malicious	Unknown	Browse
	Space.spc.elf	Get hash	malicious	Mirai	Browse
	Space.ppc.elf	Get hash	malicious	Unknown	Browse
	Space.arc.elf	Get hash	malicious	Mirai	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
	FBI.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	FBI.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	FBI.arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse
91.189.91.42	IdpLihor52.elf	Get hash	malicious	Unknown	Browse
	Space.mips.elf	Get hash	malicious	Unknown	Browse
	rrrdsl.elf	Get hash	malicious	Unknown	Browse
	Space.spc.elf	Get hash	malicious	Mirai	Browse
	Space.ppc.elf	Get hash	malicious	Unknown	Browse
	Space.arc.elf	Get hash	malicious	Mirai	Browse
	mips.elf	Get hash	malicious	Unknown	Browse
	FBI.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	FBI.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse
	FBI.arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CANONICAL-ASGB	IdpLihor52.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Space.mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	rrrdsl.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Space.spc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	Space.ppc.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	Space.mpsl.elf	Get hash	malicious	Unknown	Browse	185.125.190.26
	Space.arc.elf	Get hash	malicious	Mirai	Browse	91.189.91.42
	mips.elf	Get hash	malicious	Unknown	Browse	91.189.91.42
	FBI.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
	FBI.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	91.189.91.42
TENET-1ZA	mpsl.elf	Get hash	malicious	Unknown	Browse	196.249.235.236
	1743035795fec993702d170fc1d5fd545dea9af440ec205ee9aac9a00c565c109331cf51fb663.dat-decoded.exe	Get hash	malicious	AsyncRAT	Browse	146.70.57.58
	resgod.sh4.elf	Get hash	malicious	Mirai	Browse	196.249.235.206
	sora.mips.elf	Get hash	malicious	Mirai	Browse	146.239.92.51
	efefa7.elf	Get hash	malicious	Mirai	Browse	146.70.175.224
	sh4.elf	Get hash	malicious	Gafgyt, Okiru	Browse	196.24.112.161
	SecuriteInfo.com.Win32.HLLW.Phorpiex.1488.10073.19908.exe	Get hash	malicious	Phorpiex, Xmrig	Browse	146.70.53.161
	wjfOfXh.exe1.exe	Get hash	malicious	Unknown	Browse	146.70.222.38
	EnLm2lWbBy.exe	Get hash	malicious	Unknown	Browse	146.70.106.77
	EnLm2lWbBy.exe	Get hash	malicious	Unknown	Browse	146.70.106.77
INIT7CH	IdpLihor52.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Space.mips.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	rrrdsl.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Space.spc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	Space.ppc.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	Space.arc.elf	Get hash	malicious	Mirai	Browse	109.202.202.202
	mips.elf	Get hash	malicious	Unknown	Browse	109.202.202.202
	FBI.mpsl.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	FBI.x86.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
	FBI.arm5.elf	Get hash	malicious	Gafgyt, Mirai	Browse	109.202.202.202
AMAZON-02US	https://antiphishing.vadesecure.com/v4?f=UDFHVW92eHFSOWFPcjdIV9jAwZ9UCXeAAq9wfoiCS4fQ30-qbnD5Qh1yl2wAQRPjKseMKrZlrPijqtPMb2ibCkT1C0AVXS0XWHzCePw8_7X7tN19fld5rxTjt1MAuFSD&i=RG9SZ1QzZDRWMDFqTXlZcWQieUMQtI6qKCAeLfw4eWU&k=Rk11&r=bmU0Y0dJNkw5VE1hQ2dqVhq3ygyznhSy2fu-P_HpDXts-dDdBFOuYa01z9Y1lKIl9csr7ge-EmOMBLb1Hu-oZw&s=882ad24911559ce9c132c0096f80c9caa23486140ec215670714dbc9a2327ca4&u=https%3A%2F%2Flnk.pmlta-etaa-0.ovh%2FTzb6pDTDvwaGVDpr22vaWMqqA%2F097117114105097110101046109097098121045114097117100064099104097110116105101114115045097116108097110116105113117101046099111109%2Fm70D23600555%2FversionWeb.html	Get hash	malicious	Unknown	Browse	108.139.29.55
	FW What it takes to build a great search mobile experience.msg	Get hash	malicious	Unknown	Browse	108.138.128.37
	CV MATINA HERMIDA.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	https://b.instlytrk.com/api/trkv2?tid=YWV5Y243Y1laSWVZR2lKK01NZ1pNN2twMWlmSzdSdmFKcTdwdDdNYXpTc01DWWJFTWZPTXdpVGpSY1NHN09Yd1hXYlN4NDRCdGFjQWQvbzNmYklObWN3QVY1ZVNtcElBRk11b0tTaDVOYkkvRTdTV2JxenFadUlsMVB6RmI5b1JxZHgvZVVJdkFydDExREpFeGhPRHVjSVAyVTkvRUdSaVZCN0Z3dFJnQ2hRdWJqOHpFOEIwMUREbzJsYm9KRW9qaS91M2wvaGI4TzlBNmxaZlNoOU1uQjNvaXJBSFBSd0ZPTXBSM3BGQ1ZSYWgxY1RZOHZteXYzUmdidEZCU2lmUkNuV0RvUThKcnJDU09YUTF1N3lTMVVYRlp3OWdnNVpUSThRZWZFVlZ0TTBkWFBpYU1EM21wQVhyaFlreHdTNDg	Get hash	malicious	Unknown	Browse	108.139.47.99
	INQUIRY - SQD25ME005-xsl.exe	Get hash	malicious	FormBook	Browse	13.248.169.48
	IdpLihor52.elf	Get hash	malicious	Unknown	Browse	18.167.12.195
	RFQ DETAILS.exe	Get hash	malicious	FormBook	Browse	13.226.94.19
	PO25022-INQ.js	Get hash	malicious	FormBook	Browse	13.248.169.48
	Swift_advice.js	Get hash	malicious	FormBook	Browse	13.248.169.48
	DHL AWB TRACKING DETAILS.exe	Get hash	malicious	FormBook	Browse	18.162.124.14

JA3 Fingerprints

⊘No context

Dropped Files

⊘No context

Created / dropped Files

/etc/ld.so.preload

Download File

Process:	/tmp/825.elf
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	34
Entropy (8bit):	4.175123135113461
Encrypted:	false
SSDEEP:	3:/qdR63SMjLNj:/qdY/3Nj
MD5:	3667162F824C13B03C42749611D389C8
SHA1:	3B0C29FD2079CEFD1FF13F9260D2A9C311DC5AD5
SHA-256:	B8B975818566332FA0E12460516FA18BA4666FABC605CB4B1819096E591CD47D
SHA-512:	1EBA85FF3AB8A8A7E2BEFDCF01D5CF336C49670D00059B72AE6CC1A502743C3EDCDAF1687D8A84A70CDC4C458A0B3D80D6FFBFE7756A63000731F85E5D297B61
Malicious:	true
Reputation:	low
Preview:	/lib/x86_64-linux-gnu/libcext.so.2

/usr/lib/x86_64-linux-gnu/libcext.so.2

Download File

Process:	/tmp/825.elf
File Type:	ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, BuildID[sha1]=00caf4d90be60b7b71ef66f374d594a4ba6f1eaf, stripped
Category:	dropped
Size (bytes):	35160
Entropy (8bit):	4.749763381191989
Encrypted:	false
SSDEEP:	768:Q4OV3n/3PHfXvn/3PHfXvn/3PHfayqC6SKiayq5l/kMkcjgMVokJR9kq0okBB9:Q4FjgSR0oY9
MD5:	D834905F4762FDEF0BE013E74BDCA22A
SHA1:	C157B4BDA01A02257E983E191F2E519CFF43C1FE
SHA-256:	BF503B5EB456F74187A17BB8C08BCCC9B3D91A7F0F6FD50110540B051510D1CA
SHA-512:	BDAB3D006D94ADB6490620F0CECD58C7711569E4453C6E9893C49D8DB2701454F3DD4EDDDFC80CBE10E0A755D4D8ECD29B3A957E451DCEC53FDAF8FF9A4643F9
Malicious:	false
Reputation:	low
Preview:	.ELF..............>......$......@.......X...........@.8...@..................................... ....... ........................ ....... ....... ......-D......-D.......................p.......p.......p......\|.......\|........................}......................8.......H8.......................~.............................................................................. ....... ...............................................$.......$...............S.td............................ ....... ...............P.td.....q.......q.......q......<.......<...............Q.td....................................................R.td.....}..........................................................GNU.............................GNU........{q.f.t...o..........'.............!....A....(. ..P...........H.'...(...*...,...............0...2...4...6...7.......:...<...=...>...-...v.\|._9.....7..zV.O.}.s..e..!t...3..'U..j...Ja..#. ...=ms....?]..]Ust,.`...a..v....]..>+.."............................$.......

/var/log/cross/auto-color

Download File

Process:	/tmp/825.elf
File Type:	ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=043cd4c5b9346b072d4c6dff0a87092556031018, for GNU/Linux 3.2.0, stripped
Category:	dropped
Size (bytes):	229160
Entropy (8bit):	5.566585103251853
Encrypted:	false
SSDEEP:	6144:23HD06tAFvXJwKwVyfDm97Hjf7fffffffffffff6ffffffffn6ffnfffeffffffX:23jlCXJZEyfDaf7fffffffffffff6ffE
MD5:	825BAB4FD9B73D70E8AC9B79126A85CD
SHA1:	0EA8246EBD864F36585FEFB4F94C099C3C64B270
SHA-256:	270FC72074C697BA5921F7B61A6128B968CA6CCBF8906645E796CFC3072D4C43
SHA-512:	1C85472BF5C2AF57458D5BC1AF3D6F12B4A105249E5C3DF41215B3CDEFE22ECD09B7A2A23E26F9D0A882AF73CADE8BC18EB0FA3E3810ABE2683910B2511CA69C
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: ReversingLabs, Detection: 22% Antivirus: Virustotal, Detection: 23%, Browse
Reputation:	low
Preview:	.ELF..............>......d......@........v..........@.8...@.".!.........@.......@.......@.......................................P.......P.......P...............................................................PE......PE.......................P.......P.......P......A.......A........................P.......P.......P.......................................X.......h.......h.............../......................pi......py......py...... ....... .......................p.......p.......p....... ....... ...............................................D.......D........................X.......h.......h..............................S.td....p.......p.......p....... ....... ...............P.td....................................................Q.td....................................................R.td.....X.......h.......h......8.......8.............../lib64/ld-linux-x86-64.so.2.................GNU.............................GNU..<..4k.-Lm....%V...............GNU.....................................

/var/log/cross/config-err-20FF3326

Download File

Process:	/tmp/825.elf
File Type:	data
Category:	dropped
Size (bytes):	8
Entropy (8bit):	3.0
Encrypted:	false
SSDEEP:	3:K:K
MD5:	ABD03C5C37CDFEDFE396C848DE9F67D4
SHA1:	1580EC4BC928A5234B7E9D9E60A242C02CFB910F
SHA-256:	3F451D8F0DCF6C6089D3A21375EAED1693023AC7D619DA430FAC3C42FD8D4AF9
SHA-512:	562B0DFE78AF08E6157F2ADCEA85E6B2036BB41D9D9657E86E37000BC7562762D393FF97D5C49C2C400959F15688607A69A7CC50D5B9269CEF56C2007C9FCF90
Malicious:	false
Reputation:	low
Preview:	.nK....?

Static File Info

General

File type:	ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=043cd4c5b9346b072d4c6dff0a87092556031018, for GNU/Linux 3.2.0, stripped
Entropy (8bit):	5.566585103251853
TrID:	ELF Executable and Linkable format (Linux) (4029/14) 49.77% ELF Executable and Linkable format (generic) (4004/1) 49.46% Lumena CEL bitmap (63/63) 0.78%
File name:	825.elf
File size:	229'160 bytes
MD5:	825bab4fd9b73d70e8ac9b79126a85cd
SHA1:	0ea8246ebd864f36585fefb4f94c099c3c64b270
SHA256:	270fc72074c697ba5921f7b61a6128b968ca6ccbf8906645e796cfc3072d4c43
SHA512:	1c85472bf5c2af57458d5bc1af3d6f12b4a105249e5c3df41215b3cdefe22ecd09b7a2a23e26f9d0a882af73cade8bc18eb0fa3e3810abe2683910b2511ca69c
SSDEEP:	6144:23HD06tAFvXJwKwVyfDm97Hjf7fffffffffffff6ffffffffn6ffnfffeffffffX:23jlCXJZEyfDaf7fffffffffffff6ffE
TLSH:	F724181BB2B199BDD09AF0708ACBD1A26871B0F42735757F37829C732D27D940BAC661
File Content Preview:	.ELF..............>......d......@........v..........@.8...@.".!.........@.......@.......@.......................................P.......P.......P...............................................................PE......PE.......................P.......P.....

Static ELF Info

ELF header
Class:	ELF64
Data:	2's complement, little endian
Version:	1 (current)
Machine:	Advanced Micro Devices X86-64
Version Number:	0x1
Type:	DYN (Shared object file)
OS/ABI:	UNIX - System V
ABI Version:	0
Entry Point Address:	0x6480
Flags:	0x0
ELF Header Size:	64
Program Header Offset:	64
Program Header Size:	56
Number of Program Headers:	14
Section Header Offset:	226984
Section Header Size:	64
Number of Section Headers:	34
Header String Table Index:	33

Sections

Name	Type	Address	Offset	Size	EntSize	Flags	Flags Description	Link	Info	Align
	NULL	0x0	0x0	0x0	0x0	0x0		0	0	0
.interp	PROGBITS	0x350	0x350	0x1c	0x0	0x2	A	0	0	1
.note.gnu.property	NOTE	0x370	0x370	0x20	0x0	0x2	A	0	0	8
.note.gnu.build-id	NOTE	0x390	0x390	0x24	0x0	0x2	A	0	0	4
.note.ABI-tag	NOTE	0x3b4	0x3b4	0x20	0x0	0x2	A	0	0	4
.gnu.hash	GNU_HASH	0x3d8	0x3d8	0x38	0x0	0x2	A	6	0	8
.dynsym	DYNSYM	0x410	0x410	0xd20	0x18	0x2	A	7	1	8
.dynstr	STRTAB	0x1130	0x1130	0x5dd	0x0	0x2	A	0	0	1
.gnu.version	VERSYM	0x170e	0x170e	0x118	0x2	0x2	A	6	0	2
.gnu.version_r	VERNEED	0x1828	0x1828	0xd0	0x0	0x2	A	7	4	8
.rela.dyn	RELA	0x18f8	0x18f8	0x2058	0x18	0x2	A	6	0	8
.rela.plt	RELA	0x3950	0x3950	0xc00	0x18	0x42	AI	6	28	8
.init	PROGBITS	0x5000	0x5000	0x1b	0x0	0x6	AX	0	0	4
.plt	PROGBITS	0x5020	0x5020	0x810	0x10	0x6	AX	0	0	16
.plt.got	PROGBITS	0x5830	0x5830	0x20	0x10	0x6	AX	0	0	16
.plt.sec	PROGBITS	0x5850	0x5850	0x800	0x10	0x6	AX	0	0	16
.text	PROGBITS	0x6050	0x6050	0x1dfe3	0x0	0x6	AX	0	0	16
.fini	PROGBITS	0x24034	0x24034	0xd	0x0	0x6	AX	0	0	4
.rodata	PROGBITS	0x25000	0x25000	0xa780	0x0	0x2	A	0	0	32
.stapsdt.base	PROGBITS	0x2f780	0x2f780	0x1	0x0	0x2	A	0	0	1
.eh_frame_hdr	PROGBITS	0x2f784	0x2f784	0xe0c	0x0	0x2	A	0	0	4
.eh_frame	PROGBITS	0x30590	0x30590	0x42f0	0x0	0x2	A	0	0	8
.gcc_except_table	PROGBITS	0x34880	0x34880	0x689	0x0	0x2	A	0	0	4
.tbss	NOBITS	0x368c8	0x358c8	0x10	0x0	0x403	WAT	0	0	8
.init_array	INIT_ARRAY	0x368c8	0x358c8	0x10	0x8	0x3	WA	0	0	8
.fini_array	FINI_ARRAY	0x368d8	0x358d8	0x8	0x8	0x3	WA	0	0	8
.data.rel.ro	PROGBITS	0x368e0	0x358e0	0x1090	0x0	0x3	WA	0	0	32
.dynamic	DYNAMIC	0x37970	0x36970	0x220	0x10	0x3	WA	7	0	8
.got	PROGBITS	0x37b90	0x36b90	0x458	0x8	0x3	WA	0	0	8
.data	PROGBITS	0x38000	0x37000	0x448	0x0	0x3	WA	0	0	32
.bss	NOBITS	0x38460	0x37448	0x1380	0x0	0x3	WA	0	0	32
.comment	PROGBITS	0x0	0x37448	0x2b	0x1	0x30	MS	0	0	1
.note.stapsdt	NOTE	0x0	0x37474	0xe8	0x0	0x0		0	0	4
.shstrtab	STRTAB	0x0	0x3755c	0x14b	0x0	0x0		0	0	1

Program Segments

Type	Offset	Virtual Address	Physical Address	File Size	Memory Size	Entropy	Flags	Flags Description	Align	Prog Interpreter	Section Mappings
PHDR	0x40	0x40	0x40	0x310	0x310	1.8570	0x4	R	0x8
INTERP	0x350	0x350	0x350	0x1c	0x1c	3.9408	0x4	R	0x1	/lib64/ld-linux-x86-64.so.2	.interp
LOAD	0x0	0x0	0x0	0x4550	0x4550	2.7119	0x4	R	0x1000		.interp .note.gnu.property .note.gnu.build-id .note.ABI-tag .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt
LOAD	0x5000	0x5000	0x5000	0x1f041	0x1f041	6.0673	0x5	R E	0x1000		.init .plt .plt.got .plt.sec .text .fini
LOAD	0x25000	0x25000	0x25000	0xff09	0xff09	5.3929	0x4	R	0x1000		.rodata .stapsdt.base .eh_frame_hdr .eh_frame .gcc_except_table
LOAD	0x358c8	0x368c8	0x368c8	0x1b80	0x2f18	2.2980	0x6	RW	0x1000		.tbss .init_array .fini_array .data.rel.ro .dynamic .got .data .bss
DYNAMIC	0x36970	0x37970	0x37970	0x220	0x220	1.5914	0x6	RW	0x8		.dynamic
NOTE	0x370	0x370	0x370	0x20	0x20	1.8716	0x4	R	0x8		.note.gnu.property
NOTE	0x390	0x390	0x390	0x44	0x44	3.2862	0x4	R	0x4		.note.gnu.build-id .note.ABI-tag
TLS	0x358c8	0x368c8	0x368c8	0x0	0x10	0.0000	0x4	R	0x8		.tbss
GNU_PROPERTY	0x370	0x370	0x370	0x20	0x20	1.8716	0x4	R	0x8		.note.gnu.property
GNU_EH_FRAME	0x2f784	0x2f784	0x2f784	0xe0c	0xe0c	5.4084	0x4	R	0x4		.eh_frame_hdr
GNU_STACK	0x0	0x0	0x0	0x0	0x0	0.0000	0x6	RW	0x10
GNU_RELRO	0x358c8	0x368c8	0x368c8	0x1738	0x1738	2.3491	0x4	R	0x1		.tbss .init_array .fini_array .data.rel.ro .dynamic .got

Dynamic Tags

Type	Meta	Value	Tag
DT_NEEDED	sharedlib	libpthread.so.0	0x1
DT_NEEDED	sharedlib	libdl.so.2	0x1
DT_NEEDED	sharedlib	libc.so.6	0x1
DT_NEEDED	sharedlib	ld-linux-x86-64.so.2	0x1
DT_INIT	value	0x5000	0xc
DT_FINI	value	0x24034	0xd
DT_INIT_ARRAY	value	0x368c8	0x19
DT_INIT_ARRAYSZ	bytes	16	0x1b
DT_FINI_ARRAY	value	0x368d8	0x1a
DT_FINI_ARRAYSZ	bytes	8	0x1c
DT_GNU_HASH	value	0x3d8	0x6ffffef5
DT_STRTAB	value	0x1130	0x5
DT_SYMTAB	value	0x410	0x6
DT_STRSZ	bytes	1501	0xa
DT_SYMENT	bytes	24	0xb
DT_DEBUG	value	0x0	0x15
DT_PLTGOT	value	0x37b90	0x3
DT_PLTRELSZ	bytes	3072	0x2
DT_PLTREL	pltrel	DT_RELA	0x14
DT_JMPREL	value	0x3950	0x17
DT_RELA	value	0x18f8	0x7
DT_RELASZ	bytes	8280	0x8
DT_RELAENT	bytes	24	0x9
DT_FLAGS	value	0x8	0x1e
DT_FLAGS_1	value	0x8000001	0x6ffffffb
DT_VERNEED	value	0x1828	0x6ffffffe
DT_VERNEEDNUM	value	4	0x6fffffff
DT_VERSYM	value	0x170e	0x6ffffff0
DT_RELACOUNT	value	336	0x6ffffff9
DT_NULL	value	0x0	0x0

Symbols

Name	Version Info Name	Version Info File Name	Section Name	Value	Size	Symbol Type	Symbol Bind	Symbol Visibility	Ndx
			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_ITM_deregisterTMCloneTable			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
_ITM_registerTMCloneTable			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__cxa_atexit	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__cxa_finalize	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__environ	GLIBC_2.2.5	libc.so.6	.dynsym	0x38460	8	OBJECT	<unknown>	DEFAULT	30
__errno_location	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__fxstat	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__gmon_start__			.dynsym	0x0	0	NOTYPE	<unknown>	DEFAULT	SHN_UNDEF
__isoc99_sscanf	GLIBC_2.7	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__libc_start_main	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__pthread_key_create	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__sprintf_chk	GLIBC_2.3.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__stack_chk_fail	GLIBC_2.4	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__tls_get_addr	GLIBC_2.3	ld-linux-x86-64.so.2	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
__xstat	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
_environ	GLIBC_2.2.5	libc.so.6	.dynsym	0x38460	8	OBJECT	<unknown>	DEFAULT	30
abort	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
accept	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
access	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
atoi	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
bind	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
chdir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
chmod	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
close	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
closedir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
connect	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
dl_iterate_phdr	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
dladdr	GLIBC_2.2.5	libdl.so.2	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
dlopen	GLIBC_2.2.5	libdl.so.2	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
dlsym	GLIBC_2.2.5	libdl.so.2	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
dup2	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
environ	GLIBC_2.2.5	libc.so.6	.dynsym	0x38460	8	OBJECT	<unknown>	DEFAULT	30
execv	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
execve	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
exit	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fcntl	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fileno	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
flock	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fork	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fputc	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fputs	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fread	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
free	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fsync	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
ftruncate	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
futimens	GLIBC_2.6	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
fwrite	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
get_nprocs_conf	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getdtablesize	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
geteuid	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
gethostbyname	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
gethostname	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getpeername	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getpgid	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getpid	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getpwuid	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getsockname	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
getsockopt	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
gettimeofday	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
gmtime	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
htonl	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
htons	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
inet_ntoa	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
kill	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
listen	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
localtime	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
lseek	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
lseek64	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
malloc	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
mallopt	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memcmp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memcpy	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
memset	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
mkdir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
mktime	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
ntohl	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
ntohs	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
open	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
opendir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pclose	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pipe	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
popen	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
printf	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_attr_destroy	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_attr_init	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_attr_setdetachstate	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_attr_setstacksize	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_cond_destroy	GLIBC_2.3.2	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_cond_init	GLIBC_2.3.2	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_cond_signal	GLIBC_2.3.2	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_cond_timedwait	GLIBC_2.3.2	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_cond_wait	GLIBC_2.3.2	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_create	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_join	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_mutex_destroy	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_mutex_init	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_mutex_lock	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_mutex_unlock	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_mutexattr_destroy	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_mutexattr_init	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_mutexattr_settype	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
pthread_once	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
puts	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
read	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
readdir	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
readlink	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
realloc	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
recv	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
recvfrom	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
remove	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
rename	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
select	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
send	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sendto	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
setsid	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
setsockopt	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
shmat	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
shmget	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
snprintf	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
socket	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
sprintf	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
statfs	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
stderr	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	OBJECT	<unknown>	DEFAULT	SHN_UNDEF
strcasecmp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcat	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcmp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strcpy	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strerror	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strlen	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strncasecmp	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
strtol	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
syscall	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
time	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
umask	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
unlink	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
usleep	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
utimensat	GLIBC_2.6	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
waitpid	GLIBC_2.2.5	libc.so.6	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF
write	GLIBC_2.2.5	libpthread.so.0	.dynsym	0x0	0	FUNC	<unknown>	DEFAULT	SHN_UNDEF

Network Behavior

Download Network PCAP: filtered – full

Network Port Distribution

Total Packets: 374
• 443 (HTTPS)
• 80 (HTTP)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 2, 2025 10:37:45.374598980 CEST	43928	443	192.168.2.23	91.189.91.42
Apr 2, 2025 10:37:47.123356104 CEST	59212	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:37:47.123397112 CEST	443	59212	146.70.41.178	192.168.2.23
Apr 2, 2025 10:37:47.123449087 CEST	59212	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:37:47.123955011 CEST	59212	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:37:47.123967886 CEST	443	59212	146.70.41.178	192.168.2.23
Apr 2, 2025 10:37:47.124099970 CEST	443	59212	146.70.41.178	192.168.2.23
Apr 2, 2025 10:37:51.005844116 CEST	42836	443	192.168.2.23	91.189.91.43
Apr 2, 2025 10:37:51.134423971 CEST	59218	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:37:51.134478092 CEST	443	59218	146.70.41.178	192.168.2.23
Apr 2, 2025 10:37:51.134529114 CEST	59218	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:37:51.134821892 CEST	59218	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:37:51.134834051 CEST	443	59218	146.70.41.178	192.168.2.23
Apr 2, 2025 10:37:51.134946108 CEST	443	59218	146.70.41.178	192.168.2.23
Apr 2, 2025 10:37:52.285639048 CEST	42516	80	192.168.2.23	109.202.202.202
Apr 2, 2025 10:37:55.148490906 CEST	59224	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:37:55.148529053 CEST	443	59224	146.70.41.178	192.168.2.23
Apr 2, 2025 10:37:55.148569107 CEST	59224	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:37:55.149532080 CEST	59224	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:37:55.149547100 CEST	443	59224	146.70.41.178	192.168.2.23
Apr 2, 2025 10:37:55.149667978 CEST	443	59224	146.70.41.178	192.168.2.23
Apr 2, 2025 10:37:59.160455942 CEST	59230	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:37:59.160495996 CEST	443	59230	146.70.41.178	192.168.2.23
Apr 2, 2025 10:37:59.160542965 CEST	59230	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:37:59.160955906 CEST	59230	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:37:59.160972118 CEST	443	59230	146.70.41.178	192.168.2.23
Apr 2, 2025 10:37:59.161084890 CEST	443	59230	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:03.172097921 CEST	59236	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:03.172175884 CEST	443	59236	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:03.172336102 CEST	59236	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:03.172461033 CEST	59236	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:03.172481060 CEST	443	59236	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:03.172600985 CEST	443	59236	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:05.283119917 CEST	39276	443	192.168.2.23	34.249.145.219
Apr 2, 2025 10:38:05.283175945 CEST	443	39276	34.249.145.219	192.168.2.23
Apr 2, 2025 10:38:05.283272982 CEST	39276	443	192.168.2.23	34.249.145.219
Apr 2, 2025 10:38:05.283915043 CEST	39276	443	192.168.2.23	34.249.145.219
Apr 2, 2025 10:38:05.283930063 CEST	443	39276	34.249.145.219	192.168.2.23
Apr 2, 2025 10:38:05.851746082 CEST	43928	443	192.168.2.23	91.189.91.42
Apr 2, 2025 10:38:07.183976889 CEST	59244	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:07.184035063 CEST	443	59244	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:07.184108019 CEST	59244	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:07.184583902 CEST	59244	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:07.184597969 CEST	443	59244	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:07.184669971 CEST	443	59244	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:11.198100090 CEST	59250	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:11.198149920 CEST	443	59250	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:11.198254108 CEST	59250	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:11.198678017 CEST	59250	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:11.198688984 CEST	443	59250	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:11.198743105 CEST	443	59250	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:15.214118004 CEST	59256	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:15.214220047 CEST	443	59256	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:15.214313030 CEST	59256	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:15.214854002 CEST	59256	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:15.214890003 CEST	443	59256	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:15.214945078 CEST	443	59256	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:18.138221979 CEST	42836	443	192.168.2.23	91.189.91.43
Apr 2, 2025 10:38:19.226185083 CEST	59262	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:19.226249933 CEST	443	59262	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:19.226308107 CEST	59262	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:19.226562977 CEST	59262	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:19.226574898 CEST	443	59262	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:19.226707935 CEST	443	59262	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:22.233551979 CEST	42516	80	192.168.2.23	109.202.202.202
Apr 2, 2025 10:38:23.239238977 CEST	59268	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:23.239296913 CEST	443	59268	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:23.239377975 CEST	59268	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:23.239846945 CEST	59268	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:23.239864111 CEST	443	59268	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:23.239928961 CEST	443	59268	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:27.254744053 CEST	59274	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:27.254853964 CEST	443	59274	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:27.254928112 CEST	59274	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:27.255249977 CEST	59274	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:27.255285025 CEST	443	59274	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:27.255330086 CEST	443	59274	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:31.267265081 CEST	59280	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:31.267317057 CEST	443	59280	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:31.267415047 CEST	59280	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:31.267779112 CEST	59280	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:31.267786980 CEST	443	59280	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:31.267872095 CEST	443	59280	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:35.278876066 CEST	59286	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:35.278923035 CEST	443	59286	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:35.278999090 CEST	59286	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:35.279273033 CEST	59286	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:35.279284954 CEST	443	59286	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:35.279330015 CEST	443	59286	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:39.292553902 CEST	59292	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:39.292612076 CEST	443	59292	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:39.292711973 CEST	59292	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:39.293025017 CEST	59292	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:39.293034077 CEST	443	59292	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:39.293072939 CEST	443	59292	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:43.305821896 CEST	59298	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:43.305933952 CEST	443	59298	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:43.306032896 CEST	59298	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:43.306160927 CEST	59298	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:43.306185961 CEST	443	59298	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:43.306363106 CEST	443	59298	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:46.806240082 CEST	43928	443	192.168.2.23	91.189.91.42
Apr 2, 2025 10:38:47.318182945 CEST	59304	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:47.318226099 CEST	443	59304	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:47.318295002 CEST	59304	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:47.318787098 CEST	59304	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:47.318804026 CEST	443	59304	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:47.318867922 CEST	443	59304	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:51.334150076 CEST	59310	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:51.334189892 CEST	443	59310	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:51.334285975 CEST	59310	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:51.334676981 CEST	59310	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:51.334691048 CEST	443	59310	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:51.334737062 CEST	443	59310	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:55.348742962 CEST	59316	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:55.348860025 CEST	443	59316	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:55.348942041 CEST	59316	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:55.349098921 CEST	59316	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:55.349136114 CEST	443	59316	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:55.349189043 CEST	443	59316	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:59.361040115 CEST	59322	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:59.361083984 CEST	443	59322	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:59.361155987 CEST	59322	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:59.361439943 CEST	59322	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:38:59.361449957 CEST	443	59322	146.70.41.178	192.168.2.23
Apr 2, 2025 10:38:59.361507893 CEST	443	59322	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:03.373177052 CEST	59328	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:03.373238087 CEST	443	59328	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:03.373289108 CEST	59328	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:03.373486042 CEST	59328	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:03.373502016 CEST	443	59328	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:03.373547077 CEST	443	59328	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:05.275445938 CEST	39276	443	192.168.2.23	34.249.145.219
Apr 2, 2025 10:39:05.316359997 CEST	443	39276	34.249.145.219	192.168.2.23
Apr 2, 2025 10:39:07.383321047 CEST	59334	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:07.383384943 CEST	443	59334	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:07.383451939 CEST	59334	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:07.383658886 CEST	59334	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:07.383675098 CEST	443	59334	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:07.383719921 CEST	443	59334	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:11.393871069 CEST	59340	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:11.393924952 CEST	443	59340	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:11.393965006 CEST	59340	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:11.394218922 CEST	59340	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:11.394228935 CEST	443	59340	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:11.394382954 CEST	443	59340	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:15.403325081 CEST	59346	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:15.403378963 CEST	443	59346	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:15.403460026 CEST	59346	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:15.403666973 CEST	59346	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:15.403680086 CEST	443	59346	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:15.403717041 CEST	443	59346	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:19.415262938 CEST	59352	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:19.415299892 CEST	443	59352	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:19.415360928 CEST	59352	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:19.415740967 CEST	59352	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:19.415749073 CEST	443	59352	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:19.415779114 CEST	443	59352	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:23.427710056 CEST	59358	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:23.427751064 CEST	443	59358	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:23.427808046 CEST	59358	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:23.428229094 CEST	59358	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:23.428237915 CEST	443	59358	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:23.428277969 CEST	443	59358	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:27.437844992 CEST	59364	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:27.437892914 CEST	443	59364	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:27.437943935 CEST	59364	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:27.438216925 CEST	59364	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:27.438230991 CEST	443	59364	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:27.438271999 CEST	443	59364	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:31.447762012 CEST	59370	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:31.447839022 CEST	443	59370	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:31.447904110 CEST	59370	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:31.448084116 CEST	59370	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:31.448093891 CEST	443	59370	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:31.448184013 CEST	443	59370	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:35.458931923 CEST	59376	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:35.459042072 CEST	443	59376	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:35.459134102 CEST	59376	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:35.459331989 CEST	59376	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:35.459353924 CEST	443	59376	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:35.459429026 CEST	443	59376	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:39.468957901 CEST	59382	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:39.469005108 CEST	443	59382	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:39.469082117 CEST	59382	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:39.469152927 CEST	59382	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:39.469160080 CEST	443	59382	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:39.469248056 CEST	443	59382	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:43.488547087 CEST	59388	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:43.488594055 CEST	443	59388	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:43.488715887 CEST	59388	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:43.489219904 CEST	59388	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:43.489229918 CEST	443	59388	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:43.489278078 CEST	443	59388	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:47.508646965 CEST	59394	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:47.508701086 CEST	443	59394	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:47.508759975 CEST	59394	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:47.509294987 CEST	59394	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:47.509313107 CEST	443	59394	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:47.509371042 CEST	443	59394	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:51.527149916 CEST	59400	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:51.527206898 CEST	443	59400	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:51.527331114 CEST	59400	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:51.527923107 CEST	59400	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:51.527947903 CEST	443	59400	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:51.528000116 CEST	443	59400	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:55.544691086 CEST	59406	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:55.544739008 CEST	443	59406	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:55.544804096 CEST	59406	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:55.545047045 CEST	59406	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:55.545062065 CEST	443	59406	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:55.545172930 CEST	443	59406	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:59.560518980 CEST	59412	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:59.560575962 CEST	443	59412	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:59.560676098 CEST	59412	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:59.561247110 CEST	59412	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:39:59.561261892 CEST	443	59412	146.70.41.178	192.168.2.23
Apr 2, 2025 10:39:59.561377048 CEST	443	59412	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:03.571652889 CEST	59418	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:03.571716070 CEST	443	59418	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:03.571778059 CEST	59418	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:03.572046041 CEST	59418	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:03.572060108 CEST	443	59418	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:03.572094917 CEST	443	59418	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:07.582320929 CEST	59424	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:07.582364082 CEST	443	59424	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:07.582418919 CEST	59424	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:07.582741022 CEST	59424	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:07.582750082 CEST	443	59424	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:07.582784891 CEST	443	59424	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:11.594537020 CEST	59430	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:11.594585896 CEST	443	59430	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:11.594640970 CEST	59430	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:11.594913960 CEST	59430	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:11.594923973 CEST	443	59430	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:11.594950914 CEST	443	59430	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:15.606643915 CEST	59436	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:15.606704950 CEST	443	59436	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:15.606764078 CEST	59436	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:15.606983900 CEST	59436	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:15.606995106 CEST	443	59436	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:15.607043028 CEST	443	59436	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:19.619724035 CEST	59442	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:19.619779110 CEST	443	59442	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:19.619849920 CEST	59442	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:19.620244980 CEST	59442	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:19.620261908 CEST	443	59442	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:19.620305061 CEST	443	59442	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:23.631901026 CEST	59448	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:23.631941080 CEST	443	59448	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:23.632028103 CEST	59448	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:23.632230043 CEST	59448	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:23.632236004 CEST	443	59448	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:23.632352114 CEST	443	59448	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:27.642992973 CEST	59454	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:27.643045902 CEST	443	59454	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:27.643126011 CEST	59454	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:27.643318892 CEST	59454	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:27.643336058 CEST	443	59454	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:27.643383026 CEST	443	59454	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:31.659409046 CEST	59460	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:31.659465075 CEST	443	59460	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:31.659533024 CEST	59460	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:31.659738064 CEST	59460	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:31.659751892 CEST	443	59460	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:31.659799099 CEST	443	59460	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:35.673590899 CEST	59466	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:35.673648119 CEST	443	59466	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:35.673702955 CEST	59466	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:35.674166918 CEST	59466	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:35.674185991 CEST	443	59466	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:35.674249887 CEST	443	59466	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:39.688030958 CEST	59472	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:39.688087940 CEST	443	59472	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:39.688160896 CEST	59472	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:39.688452959 CEST	59472	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:39.688468933 CEST	443	59472	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:39.688522100 CEST	443	59472	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:43.703775883 CEST	59478	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:43.703845024 CEST	443	59478	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:43.703958988 CEST	59478	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:43.704334021 CEST	59478	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:43.704350948 CEST	443	59478	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:43.704401970 CEST	443	59478	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:47.718666077 CEST	59484	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:47.718715906 CEST	443	59484	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:47.718787909 CEST	59484	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:47.719149113 CEST	59484	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:47.719162941 CEST	443	59484	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:47.719214916 CEST	443	59484	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:51.735300064 CEST	59490	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:51.735361099 CEST	443	59490	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:51.735465050 CEST	59490	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:51.735927105 CEST	59490	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:51.735944033 CEST	443	59490	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:51.735991955 CEST	443	59490	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:55.749809027 CEST	59496	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:55.749871969 CEST	443	59496	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:55.749917984 CEST	59496	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:55.750209093 CEST	59496	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:55.750221968 CEST	443	59496	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:55.750262022 CEST	443	59496	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:59.764391899 CEST	59502	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:59.764448881 CEST	443	59502	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:59.764544010 CEST	59502	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:59.765013933 CEST	59502	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:40:59.765028954 CEST	443	59502	146.70.41.178	192.168.2.23
Apr 2, 2025 10:40:59.765064001 CEST	443	59502	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:03.778719902 CEST	59508	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:03.778811932 CEST	443	59508	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:03.778918028 CEST	59508	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:03.779176950 CEST	59508	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:03.779213905 CEST	443	59508	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:03.779264927 CEST	443	59508	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:07.790381908 CEST	59514	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:07.790457964 CEST	443	59514	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:07.790679932 CEST	59514	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:07.790679932 CEST	59514	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:07.790721893 CEST	443	59514	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:07.790888071 CEST	443	59514	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:11.802548885 CEST	59520	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:11.802617073 CEST	443	59520	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:11.802700043 CEST	59520	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:11.803235054 CEST	59520	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:11.803250074 CEST	443	59520	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:11.803314924 CEST	443	59520	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:15.815582037 CEST	59526	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:15.815645933 CEST	443	59526	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:15.815700054 CEST	59526	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:15.815978050 CEST	59526	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:15.815993071 CEST	443	59526	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:15.816057920 CEST	443	59526	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:19.834462881 CEST	59532	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:19.834511995 CEST	443	59532	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:19.834716082 CEST	59532	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:19.834959030 CEST	59532	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:19.834971905 CEST	443	59532	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:19.835028887 CEST	443	59532	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:23.850543976 CEST	59538	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:23.850668907 CEST	443	59538	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:23.850771904 CEST	59538	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:23.850850105 CEST	59538	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:23.850869894 CEST	443	59538	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:23.850984097 CEST	443	59538	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:27.863471031 CEST	59544	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:27.863523960 CEST	443	59544	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:27.863603115 CEST	59544	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:27.864037037 CEST	59544	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:27.864048004 CEST	443	59544	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:27.864113092 CEST	443	59544	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:31.876957893 CEST	59550	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:31.877012968 CEST	443	59550	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:31.877119064 CEST	59550	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:31.877769947 CEST	59550	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:31.877782106 CEST	443	59550	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:31.877840996 CEST	443	59550	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:35.887948036 CEST	59556	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:35.888003111 CEST	443	59556	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:35.888088942 CEST	59556	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:35.888251066 CEST	59556	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:35.888268948 CEST	443	59556	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:35.888317108 CEST	443	59556	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:39.901583910 CEST	59562	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:39.901640892 CEST	443	59562	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:39.901710987 CEST	59562	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:39.902060032 CEST	59562	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:39.902072906 CEST	443	59562	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:39.902129889 CEST	443	59562	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:43.916136980 CEST	59568	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:43.916192055 CEST	443	59568	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:43.916274071 CEST	59568	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:43.916274071 CEST	59568	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:43.916317940 CEST	443	59568	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:43.916425943 CEST	443	59568	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:47.930207014 CEST	59574	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:47.930253983 CEST	443	59574	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:47.930300951 CEST	59574	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:47.930644989 CEST	59574	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:47.930651903 CEST	443	59574	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:47.930681944 CEST	443	59574	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:51.944994926 CEST	59580	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:51.945055962 CEST	443	59580	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:51.945103884 CEST	59580	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:51.945409060 CEST	59580	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:51.945424080 CEST	443	59580	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:51.945482016 CEST	443	59580	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:55.993311882 CEST	59586	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:55.993372917 CEST	443	59586	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:55.993418932 CEST	59586	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:55.994170904 CEST	59586	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:41:55.994190931 CEST	443	59586	146.70.41.178	192.168.2.23
Apr 2, 2025 10:41:55.994244099 CEST	443	59586	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:00.009020090 CEST	59592	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:00.009068012 CEST	443	59592	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:00.009124041 CEST	59592	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:00.009414911 CEST	59592	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:00.009428978 CEST	443	59592	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:00.009488106 CEST	443	59592	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:04.025051117 CEST	59598	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:04.025110006 CEST	443	59598	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:04.025166988 CEST	59598	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:04.025724888 CEST	59598	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:04.025741100 CEST	443	59598	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:04.025816917 CEST	443	59598	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:08.038650990 CEST	59604	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:08.038698912 CEST	443	59604	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:08.038783073 CEST	59604	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:08.039052010 CEST	59604	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:08.039060116 CEST	443	59604	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:08.039093971 CEST	443	59604	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:12.051752090 CEST	59610	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:12.051808119 CEST	443	59610	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:12.051856995 CEST	59610	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:12.052122116 CEST	59610	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:12.052135944 CEST	443	59610	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:12.052195072 CEST	443	59610	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:16.069041014 CEST	59616	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:16.069149017 CEST	443	59616	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:16.069221973 CEST	59616	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:16.069454908 CEST	59616	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:16.069489002 CEST	443	59616	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:16.069600105 CEST	443	59616	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:20.123501062 CEST	59622	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:20.123553991 CEST	443	59622	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:20.123702049 CEST	59622	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:20.124375105 CEST	59622	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:20.124392986 CEST	443	59622	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:20.124440908 CEST	443	59622	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:24.138819933 CEST	59628	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:24.138870955 CEST	443	59628	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:24.138947010 CEST	59628	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:24.139137030 CEST	59628	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:24.139151096 CEST	443	59628	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:24.139204979 CEST	443	59628	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:28.152793884 CEST	59634	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:28.152836084 CEST	443	59634	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:28.152909040 CEST	59634	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:28.153609991 CEST	59634	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:28.153626919 CEST	443	59634	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:28.153758049 CEST	443	59634	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:32.169488907 CEST	59640	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:32.169539928 CEST	443	59640	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:32.169660091 CEST	59640	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:32.170154095 CEST	59640	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:32.170171976 CEST	443	59640	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:32.170233965 CEST	443	59640	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:36.180613995 CEST	59646	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:36.180665970 CEST	443	59646	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:36.180716991 CEST	59646	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:36.180985928 CEST	59646	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:36.180999041 CEST	443	59646	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:36.181034088 CEST	443	59646	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:40.195581913 CEST	59652	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:40.195619106 CEST	443	59652	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:40.195672989 CEST	59652	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:40.196008921 CEST	59652	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:40.196021080 CEST	443	59652	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:40.196075916 CEST	443	59652	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:44.207773924 CEST	59658	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:44.207825899 CEST	443	59658	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:44.207889080 CEST	59658	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:44.209199905 CEST	59658	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:44.209209919 CEST	443	59658	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:44.209255934 CEST	443	59658	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:48.224889040 CEST	59664	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:48.224937916 CEST	443	59664	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:48.225008965 CEST	59664	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:48.225332022 CEST	59664	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:48.225344896 CEST	443	59664	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:48.225418091 CEST	443	59664	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:52.238151073 CEST	59670	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:52.238208055 CEST	443	59670	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:52.238286972 CEST	59670	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:52.238789082 CEST	59670	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:52.238807917 CEST	443	59670	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:52.238866091 CEST	443	59670	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:56.250380993 CEST	59676	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:56.250435114 CEST	443	59676	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:56.250487089 CEST	59676	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:56.250780106 CEST	59676	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:42:56.250791073 CEST	443	59676	146.70.41.178	192.168.2.23
Apr 2, 2025 10:42:56.250830889 CEST	443	59676	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:00.262052059 CEST	59682	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:00.262104034 CEST	443	59682	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:00.262161970 CEST	59682	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:00.262615919 CEST	59682	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:00.262623072 CEST	443	59682	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:00.262660027 CEST	443	59682	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:04.275343895 CEST	59688	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:04.275388002 CEST	443	59688	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:04.275471926 CEST	59688	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:04.275878906 CEST	59688	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:04.275890112 CEST	443	59688	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:04.275942087 CEST	443	59688	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:08.286624908 CEST	59694	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:08.286681890 CEST	443	59694	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:08.286930084 CEST	59694	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:08.287266016 CEST	59694	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:08.287280083 CEST	443	59694	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:08.287316084 CEST	443	59694	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:12.300148010 CEST	59700	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:12.300199986 CEST	443	59700	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:12.300276995 CEST	59700	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:12.300647020 CEST	59700	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:12.300657034 CEST	443	59700	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:12.300702095 CEST	443	59700	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:16.311077118 CEST	59706	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:16.311126947 CEST	443	59706	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:16.311199903 CEST	59706	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:16.311395884 CEST	59706	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:16.311410904 CEST	443	59706	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:16.311472893 CEST	443	59706	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:20.322355986 CEST	59712	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:20.322397947 CEST	443	59712	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:20.322454929 CEST	59712	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:20.322753906 CEST	59712	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:20.322762012 CEST	443	59712	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:20.322793007 CEST	443	59712	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:24.333905935 CEST	59718	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:24.333956957 CEST	443	59718	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:24.334009886 CEST	59718	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:24.334357977 CEST	59718	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:24.334367037 CEST	443	59718	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:24.334397078 CEST	443	59718	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:28.346265078 CEST	59724	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:28.346321106 CEST	443	59724	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:28.346364975 CEST	59724	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:28.346653938 CEST	59724	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:28.346667051 CEST	443	59724	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:28.346705914 CEST	443	59724	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:32.358119011 CEST	59730	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:32.358158112 CEST	443	59730	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:32.358220100 CEST	59730	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:32.358510017 CEST	59730	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:32.358520031 CEST	443	59730	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:32.358551979 CEST	443	59730	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:36.369520903 CEST	59736	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:36.369560957 CEST	443	59736	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:36.369599104 CEST	59736	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:36.369862080 CEST	59736	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:36.369877100 CEST	443	59736	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:36.369906902 CEST	443	59736	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:40.382673025 CEST	59742	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:40.382720947 CEST	443	59742	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:40.382781982 CEST	59742	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:40.383230925 CEST	59742	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:40.383255005 CEST	443	59742	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:40.383322001 CEST	443	59742	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:44.395971060 CEST	59748	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:44.396003962 CEST	443	59748	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:44.396083117 CEST	59748	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:44.396469116 CEST	59748	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:44.396481037 CEST	443	59748	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:44.396527052 CEST	443	59748	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:48.413418055 CEST	59754	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:48.413476944 CEST	443	59754	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:48.413554907 CEST	59754	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:48.413950920 CEST	59754	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:48.413960934 CEST	443	59754	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:48.414007902 CEST	443	59754	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:52.426384926 CEST	59760	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:52.426444054 CEST	443	59760	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:52.426512003 CEST	59760	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:52.426724911 CEST	59760	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:52.426742077 CEST	443	59760	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:52.426789045 CEST	443	59760	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:56.439544916 CEST	59766	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:56.439594030 CEST	443	59766	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:56.439750910 CEST	59766	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:56.440082073 CEST	59766	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:43:56.440097094 CEST	443	59766	146.70.41.178	192.168.2.23
Apr 2, 2025 10:43:56.440130949 CEST	443	59766	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:00.452157974 CEST	59772	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:00.452212095 CEST	443	59772	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:00.452274084 CEST	59772	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:00.452728987 CEST	59772	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:00.452742100 CEST	443	59772	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:00.452807903 CEST	443	59772	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:04.468529940 CEST	59778	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:04.468569040 CEST	443	59778	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:04.468672991 CEST	59778	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:04.469273090 CEST	59778	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:04.469281912 CEST	443	59778	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:04.469314098 CEST	443	59778	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:08.482202053 CEST	59784	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:08.482264042 CEST	443	59784	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:08.482307911 CEST	59784	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:08.482563019 CEST	59784	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:08.482568979 CEST	443	59784	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:08.484394073 CEST	443	59784	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:12.499752045 CEST	59790	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:12.499819994 CEST	443	59790	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:12.499895096 CEST	59790	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:12.500418901 CEST	59790	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:12.500431061 CEST	443	59790	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:12.500484943 CEST	443	59790	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:16.517013073 CEST	59796	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:16.517070055 CEST	443	59796	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:16.517159939 CEST	59796	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:16.517714024 CEST	59796	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:16.517729044 CEST	443	59796	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:16.517780066 CEST	443	59796	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:20.531435013 CEST	59802	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:20.531496048 CEST	443	59802	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:20.531558037 CEST	59802	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:20.532095909 CEST	59802	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:20.532111883 CEST	443	59802	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:20.532208920 CEST	443	59802	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:24.543015957 CEST	59808	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:24.543076038 CEST	443	59808	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:24.543138981 CEST	59808	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:24.543412924 CEST	59808	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:24.543422937 CEST	443	59808	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:24.543466091 CEST	443	59808	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:28.556951046 CEST	59814	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:28.556994915 CEST	443	59814	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:28.557049990 CEST	59814	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:28.557446003 CEST	59814	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:28.557454109 CEST	443	59814	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:28.557490110 CEST	443	59814	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:32.569613934 CEST	59820	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:32.569673061 CEST	443	59820	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:32.569725037 CEST	59820	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:32.570025921 CEST	59820	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:32.570040941 CEST	443	59820	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:32.570082903 CEST	443	59820	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:36.583856106 CEST	59826	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:36.583908081 CEST	443	59826	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:36.583970070 CEST	59826	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:36.584427118 CEST	59826	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:36.584443092 CEST	443	59826	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:36.584526062 CEST	443	59826	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:40.598958969 CEST	59832	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:40.599014997 CEST	443	59832	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:40.599095106 CEST	59832	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:40.599589109 CEST	59832	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:40.599598885 CEST	443	59832	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:40.599636078 CEST	443	59832	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:44.613567114 CEST	59838	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:44.613611937 CEST	443	59838	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:44.613656044 CEST	59838	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:44.613989115 CEST	59838	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:44.614001989 CEST	443	59838	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:44.614056110 CEST	443	59838	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:48.626024008 CEST	59844	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:48.626075983 CEST	443	59844	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:48.626136065 CEST	59844	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:48.626442909 CEST	59844	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:48.626456976 CEST	443	59844	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:48.626513958 CEST	443	59844	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:52.638376951 CEST	59850	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:52.638441086 CEST	443	59850	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:52.638483047 CEST	59850	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:52.638794899 CEST	59850	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:52.638808012 CEST	443	59850	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:52.638850927 CEST	443	59850	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:56.656642914 CEST	59856	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:56.656691074 CEST	443	59856	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:56.656765938 CEST	59856	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:56.657288074 CEST	59856	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:44:56.657296896 CEST	443	59856	146.70.41.178	192.168.2.23
Apr 2, 2025 10:44:56.657335043 CEST	443	59856	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:00.671526909 CEST	59862	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:00.671576977 CEST	443	59862	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:00.671627998 CEST	59862	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:00.672024012 CEST	59862	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:00.672038078 CEST	443	59862	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:00.672072887 CEST	443	59862	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:04.687251091 CEST	59868	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:04.687315941 CEST	443	59868	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:04.687361956 CEST	59868	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:04.687654972 CEST	59868	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:04.687669039 CEST	443	59868	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:04.687730074 CEST	443	59868	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:08.701069117 CEST	59874	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:08.701170921 CEST	443	59874	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:08.701266050 CEST	59874	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:08.701447964 CEST	59874	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:08.701471090 CEST	443	59874	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:08.701550961 CEST	443	59874	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:12.715255022 CEST	59880	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:12.715311050 CEST	443	59880	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:12.715420961 CEST	59880	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:12.715872049 CEST	59880	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:12.715884924 CEST	443	59880	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:12.715926886 CEST	443	59880	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:16.731817007 CEST	59886	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:16.731918097 CEST	443	59886	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:16.731996059 CEST	59886	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:16.733503103 CEST	59886	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:16.733540058 CEST	443	59886	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:16.733697891 CEST	443	59886	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:20.753712893 CEST	59892	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:20.753774881 CEST	443	59892	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:20.753845930 CEST	59892	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:20.754256010 CEST	59892	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:20.754270077 CEST	443	59892	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:20.754326105 CEST	443	59892	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:24.765914917 CEST	59898	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:24.765963078 CEST	443	59898	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:24.766041994 CEST	59898	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:24.766526937 CEST	59898	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:24.766546011 CEST	443	59898	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:24.766599894 CEST	443	59898	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:28.779131889 CEST	59904	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:28.779179096 CEST	443	59904	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:28.779247999 CEST	59904	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:28.779539108 CEST	59904	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:28.779560089 CEST	443	59904	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:28.779594898 CEST	443	59904	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:32.794426918 CEST	59910	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:32.794492960 CEST	443	59910	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:32.794570923 CEST	59910	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:32.795126915 CEST	59910	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:32.795144081 CEST	443	59910	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:32.795191050 CEST	443	59910	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:36.805180073 CEST	59916	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:36.805217028 CEST	443	59916	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:36.805341959 CEST	59916	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:36.805444956 CEST	59916	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:36.805452108 CEST	443	59916	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:36.805493116 CEST	443	59916	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:40.817967892 CEST	59922	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:40.818022013 CEST	443	59922	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:40.818064928 CEST	59922	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:40.818670988 CEST	59922	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:40.818685055 CEST	443	59922	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:40.818717957 CEST	443	59922	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:44.835764885 CEST	59928	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:44.835810900 CEST	443	59928	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:44.835877895 CEST	59928	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:44.836204052 CEST	59928	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:44.836216927 CEST	443	59928	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:44.836250067 CEST	443	59928	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:48.848429918 CEST	59934	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:48.848474979 CEST	443	59934	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:48.848516941 CEST	59934	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:48.848794937 CEST	59934	443	192.168.2.23	146.70.41.178
Apr 2, 2025 10:45:48.848804951 CEST	443	59934	146.70.41.178	192.168.2.23
Apr 2, 2025 10:45:48.848839045 CEST	443	59934	146.70.41.178	192.168.2.23

System Behavior

Analysis Process: 825.elf PID: 6230, Parent PID: 6152

General

Start time (UTC):	08:37:45
Start date (UTC):	02/04/2025
Path:	/tmp/825.elf
Arguments:	/tmp/825.elf
File size:	229160 bytes
MD5 hash:	825bab4fd9b73d70e8ac9b79126a85cd

File Activities

File Opened

File Deleted

File Read

File Written

Directory Created

Process Activities

Process Forked

Chronological Activities

Analysis Process: 825.elf PID: 6231, Parent PID: 6230

General

Start time (UTC):	08:37:46
Start date (UTC):	02/04/2025
Path:	/tmp/825.elf
Arguments:	-
File size:	229160 bytes
MD5 hash:	825bab4fd9b73d70e8ac9b79126a85cd

Process Activities

Process Forked

Chronological Activities

Analysis Process: 825.elf PID: 6232, Parent PID: 6231

General

Start time (UTC):	08:37:46
Start date (UTC):	02/04/2025
Path:	/tmp/825.elf
Arguments:	-
File size:	229160 bytes
MD5 hash:	825bab4fd9b73d70e8ac9b79126a85cd

File Activities

File Opened

File Read

File Written

Directory Created

Process Activities

Thread Sleep

System Activities

Query System Information (uname)

Network Activities

Socket Connecting

Chronological Activities

Analysis Process: dash PID: 6293, Parent PID: 4331

General

Start time (UTC):	08:39:04
Start date (UTC):	02/04/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 6293, Parent PID: 4331

General

Start time (UTC):	08:39:04
Start date (UTC):	02/04/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.2jcM8VmtlL /tmp/tmp.DhMObyhwF1 /tmp/tmp.Ayz6Aytwqw
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

File Activities

File Opened

File Deleted

File Read

Chronological Activities

Analysis Process: dash PID: 6294, Parent PID: 4331

General

Start time (UTC):	08:39:04
Start date (UTC):	02/04/2025
Path:	/usr/bin/dash
Arguments:	-
File size:	129816 bytes
MD5 hash:	1e6b1c887c59a315edb7eb9a315fc84c

Process Activities

Process Overlayed (Exec)

Chronological Activities

Analysis Process: rm PID: 6294, Parent PID: 4331

General

Start time (UTC):	08:39:04
Start date (UTC):	02/04/2025
Path:	/usr/bin/rm
Arguments:	rm -f /tmp/tmp.2jcM8VmtlL /tmp/tmp.DhMObyhwF1 /tmp/tmp.Ayz6Aytwqw
File size:	72056 bytes
MD5 hash:	aa2b5496fdbfd88e38791ab81f90b95b

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit a system or application vulnerability to bypass security features. Exploitation of a vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Vulnerabilities may exist in defensive security software that can be used to disable or circumvent them.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Process: Process Creation
Platforms:	IaaS, Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete or modify artifacts generated within systems to remove evidence of their presence or hinder defenses. Various artifacts may be created by an adversary or something that can be attributed to an adversary’s actions. Typically these artifacts are used as defensive indicators related to monitored events, such as strings from downloaded files, logs that are generated from user actions, and other data analyzed by defenders. Location, format, and type of artifact (such as command or login history) are often specific to each platform.
Tactics:	Defense Evasion
Data Sources:	Application Log: Application Log Content, Command: Command Execution, File: File Deletion, File: File Metadata, File: File Modification, Firewall: Firewall Rule Modification, Network Traffic: Network Traffic Content, Process: OS API Execution, Process: Process Creation, Scheduled Job: Scheduled Job Modification, User Account: User Account Authentication, User Account: User Account Deletion, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, Google Workspace, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Linux Analysis Report 825.elf

Overview

General Information

Detection

Signatures

Classification

General Information

Runtime Messages

Process Tree

Yara Signatures

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Networking

System Summary

Persistence and Installation Behavior

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Mitre Att&ck Matrix

Malware Configuration

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

/etc/ld.so.preload

/usr/lib/x86_64-linux-gnu/libcext.so.2

/var/log/cross/auto-color

/var/log/cross/config-err-20FF3326

Static File Info

General

Static ELF Info

ELF header

Sections

Program Segments

Dynamic Tags

Symbols

Network Behavior

Network Port Distribution

TCP Packets

System Behavior

Analysis Process: 825.elf PID: 6230, Parent PID: 6152

General

File Activities

File Opened

File Deleted

File Read

File Written

Directory Created

Process Activities

Process Forked

Chronological Activities

Analysis Process: 825.elf PID: 6231, Parent PID: 6230

General

Process Activities

Process Forked

Chronological Activities

Analysis Process: 825.elf PID: 6232, Parent PID: 6231

Linux Analysis Report
825.elf